Splunk Search

How to write a regular expression for my use case?

sravankaripe
Communicator
11-01-2016 14:53:32.199 -0500 INFO  StreamedSearch - Streamed search connection terminated: search.......................

11-01-2016 15:01:31.638 -0500 WARN  DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event....................

i have a use case to display the messages for all log levels. Please help me in writing the rex for this case.

0 Karma
1 Solution

somesoni2
Revered Legend

Assuming the location of log_level field is fixed in your events (after timestamp), then give this a try

your base search | rex "^(\S+\s+){3}(?<log_level>\S+)"

View solution in original post

0 Karma

somesoni2
Revered Legend

Assuming the location of log_level field is fixed in your events (after timestamp), then give this a try

your base search | rex "^(\S+\s+){3}(?<log_level>\S+)"
0 Karma

ddrillic
Ultra Champion
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

Base Search | rex (?P<Messages>(?<=INFO|WARN).+\B)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...